Security

How to Protect Your Phone Number From SIM Swaps

Q: What should I do if I think I've been SIM swapped?

Contact your mobile carrier immediately, from another phone if needed, to reclaim your number and add account protections. Change passwords on your most important accounts — banking, email, and social media — starting with email, since it's often the recovery path for everything else. Alert your bank, monitor your accounts and credit reports, and report the fraud to the FTC and local police.

Your phone number is quietly load-bearing: it's the recovery method for your email, the destination for your bank's verification codes, the thing every "forgot your password" flow assumes only you control. A SIM swap hands that control to a stranger. Here's how to lock it down — and what to do if it's already happened.

Quick answer

Set a unique account PIN or passcode with your mobile carrier, and enable a port freeze or SIM lock so your number can't be transferred without extra verification. Replace SMS-based two-factor authentication with an authenticator app or hardware key wherever possible. Limit personal information about you available online, and watch for warning signs like sudden loss of signal. If it happens anyway, contact your carrier immediately and change your most important passwords, starting with email.

What a SIM swap actually is

A SIM swap happens when a scammer convinces your mobile carrier to transfer your phone number onto a SIM card they control — usually by impersonating you, often claiming the original phone was lost or damaged. Sometimes it happens over a phone call; sometimes in person at a store. Once the swap succeeds, your phone loses service, and every call or text meant for you — including one-time verification codes for your bank, email, or other accounts — goes to the attacker instead.

This is exactly why SIM swaps are so damaging: your phone number was never supposed to be a security credential on its own, but SMS-based two-factor authentication effectively made it one. A criminal who controls your number can often reset your way into accounts that used your phone as the recovery method.

"Your phone number was never meant to be a password. SMS-based verification quietly made it one — which is exactly what a SIM swap exploits."

The warning signs

SIM swaps often move fast, so recognizing the signs early matters. Watch for:

A sudden, unexplained loss of cell signal — your phone shows "no service" even though nothing changed on your end
Being locked out of accounts you normally access without trouble
Password reset or login alert notifications you didn't request
Calls or texts you expect simply never arriving

Any one of these on its own could be nothing. Together, or arriving suddenly, they're worth acting on immediately rather than waiting to see if it resolves itself.

How to protect yourself, step by step

Set a unique carrier account PIN Most carriers let you set a PIN or passcode required for any account change, in-store or online. Avoid predictable choices like a birth year. This is one of the single most effective protections, since it's the first thing an attacker impersonating you would need to bypass.

Enable a port freeze or number lock A port freeze (sometimes called a number lock or SIM protection) stops your number from being transferred to another carrier or SIM without extra verification. T-Mobile, AT&T, and Verizon each offer versions of this through their app or account settings — look for "SIM Protection," "Number Lock," or "port-out PIN."

Move away from SMS-based two-factor authentication Wherever an account offers it, switch from text-message codes to an authenticator app (like Google Authenticator or Authy) or a hardware security key. These are tied to your device or a physical key, not your phone number, so a SIM swap alone can't unlock them.

Limit personal information available online Attackers often build a convincing impersonation profile from publicly available details — your birthday, address, or phone number scattered across social media and data broker sites. The less is easily findable, the harder you are to impersonate convincingly.

Turn on account-change alerts Enable notifications for changes to your carrier account and your bank accounts. These alerts act as an early-warning system — the sooner you know something changed, the sooner you can act before the damage spreads.

Carrier-specific settings

T-Mobile

Account Takeover Protection + SIM Protection Service, plus a required account PIN

AT&T

Extra Security PIN and Wireless Account Lock via the myAT&T app

Verizon

SIM Protection and Number Lock, managed through the My Verizon app

Most smaller carriers and MVNOs (mobile virtual network operators reselling major networks) now offer similar protections too, though the exact names and steps vary — check your specific carrier's security or account settings section.

A note on family plans

Make sure everyone on a shared family plan knows who the primary account holder is, since that person is usually who can remove a lock or approve a legitimate transfer. It's worth keeping account numbers and port-out PINs somewhere accessible before you need them — locked-out confusion during a real phone upgrade is common enough to plan around.

If you think you've been SIM swapped

Contact your carrier immediately Use another phone if yours has lost service. Report the suspected swap, reclaim your number, and add every account protection available while you're on the call.

Change your most important passwords, starting with email Email is often the recovery path for everything else, so secure it first. Then move to banking and any financial or social accounts tied to your phone number.

Alert your bank and monitor your accounts Let your bank know you may be a fraud target. Watch statements and credit reports closely for activity you don't recognize in the days that follow.

Report the fraud File a report with the FTC at IdentityTheft.gov and consider a local police report, especially if money was actually taken. Documentation helps if you need to dispute fraudulent charges later.

A recent regulatory shift is worth knowing: the FCC has pushed carriers to take SIM swap security more seriously in recent years, which is part of why port freezes and SIM locks are now more widely available than they used to be. That said, carrier-side protections aren't a substitute for the steps you take yourself — they work best together.

Why this is worth doing before, not after

A SIM swap is a sharp example of a quietly important thing: your phone number sits underneath a dozen other accounts as their recovery method, but nothing prompts you to notice that dependency until it's exploited. Setting a carrier PIN takes a few minutes; recovering from a SIM swap that's already drained a bank account takes considerably longer.

If you're already thinking about identity protection, this pairs naturally with what to do if your SSN is leaked and what to do after a data breach — all three are about closing quiet, structural gaps before someone else finds them first.

Frequently asked questions

How do I protect my phone number from a SIM swap?

Set a unique account PIN or passcode with your mobile carrier, and enable a port freeze or SIM lock so your number can't be transferred without extra verification. Replace SMS-based two-factor authentication with an authenticator app or hardware key wherever possible, and limit personal information available online.

What is a SIM swap attack?

A SIM swap happens when a scammer convinces your mobile carrier to transfer your phone number to a SIM card they control, often by impersonating you. Once it succeeds, calls and texts meant for you — including one-time passcodes — go to the attacker instead.

What are the warning signs of a SIM swap?

A sudden, unexplained loss of cell service is the clearest sign. Other signs include being locked out of accounts you normally access easily, and receiving password reset notifications or login alerts you didn't request.

What should I do if I think I've been SIM swapped?

Contact your carrier immediately from another phone if needed. Change passwords on your most important accounts, starting with email. Alert your bank, monitor your accounts and credit reports, and report the fraud to the FTC and local police.

Does a carrier PIN fully prevent SIM swaps?

It significantly reduces the risk but isn't an absolute guarantee, since some swaps succeed through convincing impersonation or, rarely, an insider at the carrier. Combining a carrier PIN or port freeze with app-based two-factor authentication gives you layered protection.

From Attune

Join others catching what slips through the cracks

The quietly important things most people miss — money you're owed, exposure you didn't know about, costs that quietly add up. A few worth your attention, every so often. No noise.

The accounts most worth protecting are the ones you forget are connected at all.

Attune is being built as a trusted awareness layer for modern adult life — a calmer way to notice overlooked risks, hidden financial leakage, forgotten responsibilities, unused benefits, privacy exposure, and quietly important things before they disappear from view.

Get Early Access Learn what Attune is →